HCL AION contains a vulnerability where it trusts the HTTP Host header value without validation. This flaw allows an attacker to manipulate the Host header to influence links, redirects, or responses generated by the application, potentially causing unintended behavior or security issues under certain conditions. The vulnerability has a medium severity score of 6.5 and affects unspecified versions of the software.